Slashdot Mirror


User: rtfa-troll

rtfa-troll's activity in the archive.

Stories
0
Comments
2,204
First seen
Last seen
Profile
(view on slashdot.org)

Comments · 2,204

  1. Re:Siemens vs. Idaho Lab on New York Times Reports US and Israel Behind Stuxnet · · Score: 1

    The big thing in this article that stuck out for me was that Siemens participated with the Idaho National Lab to do a security audit of their software.

    We now know that cooperating with the US Government in this regard is giving up your customers to them, effectively.

    a) we don't even "know" that this was the US. We guess. The New York Times often has a specific pro-USA / pro-right wing bias in it's reporting. This might, for example be designed to claim responsibility for something that was sub-contracted out to the Chinese, but since it worked the US military-industrial complex now wants the credit.

    b) the attack was cleverly targeted and stayed well away from western/Nato countries. Clearly, if the story is correct and you are a company which is fully aligned with US military/industrial interests this should be pretty reassuring.

    c) After this, however, you would not want to be buying network equipment or systems, such as Windows, to which the Russian or Chinese government has privileged access. Everybody should be seriously reviewing their security measures. You should specifically not learn a narrow lesson from this, but a broad one. Watch out for governments who might not like you.

    What if the Siemens gear were a few generations ahead and automatically updated itself online? Would they be barred from issuing some fixes? Did Siemens even get a full report of what was found? Was their participation in this exercise a requirement for some other business contract?

    We've read previously that Stuxnet used 4 0-days in Windows to propagate. So, we can assume that part of the US Government knows about holes that affect its citizens' economic and real safety, has DHS/US-CERT in place, but does not disclose? Does CERT know about these and sit on them or are they in the dark as well?

    The US Government is not homogeneous. This split in responsibilities and the conflict of interest it entails has long existed and was very clearly demonstrated in actions such as the "Clipper chip" and the creation of the various crypto standards. There are parts of the government, such as the NSA, which are fighting for overall superiority, for example in cryptography; they may even do this at the slight cost of risk to US business interests. There are other parts, such as NIST which are specifically dedicated to protection of US business interests. Transfer of information between these groups may even be illegal (e.g. NSA agents cannot give away military secrets to NIST) and is definitely not complete.

    I'm not necessarily arguing that the ends weren't justified, but it's important to understand just how everybody's relationship is structured here with regards to computer security.

    The media companies are fucking the consumers. That is the main thing you need to know. All other forms of computer security are minor issues discussed between small groups which have little or no influence on the mass market. If you want to do serious computer security at the level where the threat from the US govt matters, you need to start talking about dedicated secure operating systems etc. etc. You need to be sure that those operating systems have been seriously reviewed at design and source code level by people who have your interests at heart and are not under influence of any large government or commercial interest aligned against you. That is a hard thing to do and is probably only available to small parts of the military of a number of rich or large countries.

  2. Re:One thing for sure on New York Times Reports US and Israel Behind Stuxnet · · Score: 1

    Formed plastic explosive connected via a brittle plastic coating designed to wear out after 1000-2000 switchings. The whole thing making a shaped charge designed to project fragments of the metal switching mechanism up at a 30 degree angle. Can we even trust the rocks in the back of the cave???

  3. Mod parent up. on New York Times Reports US and Israel Behind Stuxnet · · Score: 2

    People who are seriously religiously insane tend to spend their time at the Mosque praying. Even if there's some multiple personalities involved, at least one of the guy's personalities has to be pretty calculating to have got to the level of power he has got to in the place he got there.

  4. Re:Open Platform? on Is Samsung Blocking Updates To Froyo? · · Score: 1

    Why would I want "community" firmware on my phone?

    It really depends on who you are; there are many reasons; for example

    • Because your phone is out of support and you need some bug fixes which the manufacturer isn't willing to give you/
    • So that you can get new features faster; e.g. most new functions are developed in open source and then copied by proprietry software. If some of those features help you it may be worthwhile
    • Because you live in an oppressive regime and your firmware may be designed to bug you. You want to be sure what is going in there.
    • Because you are a CEO for whom communications are an important business issue (e.g. price negotiations) and there are security features, like end to end voice encryption, which you need for your business but the phone manufacturer can't provide due to export regulations.
    • Because you like to play around and develop new software
    • Because you want to test something which is available on another phone you are thinking of buying but is only in the community firmware for your current phone.

    Generally you should make that choice depending on what guarantees you are losing and how much benefit you get.

    I want firmware that has been built by the manufacturer and then tested so I don't miss calls or SMS messages.

    Trust me, as a person who has tested these things; your manufacturer's software in no way guarantees that.

    If you really need such a guarantee, what you really want to do is to investigate, for any given software what level exactly what testing has gone on. If you are thinking of using community software look for a phone where there are proper test suites available and they are being run. If you are talking about a large number of phones for a large corporation, it probably pays to develop through an open source support company and then release it to the community. That support company will then also be able to support your phones.

    One thing to remember is that in fact, no mobile network can guarantee message delivery in any case. The best solution to that is a voicemail system and multiple independent communication devices. E.g. two mobiles on different networks.

  5. Re:Open Platform? on Is Samsung Blocking Updates To Froyo? · · Score: 2

    You have some good point. I don't think Nokia has ever in it's life provided a major version to major version upgrade for a phone (N.B; I know they have repeatedly failed to do this for Maemo; I know that none of the many Symbian phones I have used have had version upgrades; do feel free to prove me wrong, but if you do so please tell us something about the proportion of their customers that got the benefit). The do provide regular minor version upgrades for lots of phones.

    Your point about "outside Europe" however is wrong. Outside Europe includes lots more than the USA and Canada. In Latin America, Asia and Africa where operator control over phones is much weaker than the US, Nokia still has vast market dominance. Something that will be eaten away soon if they keep failing to look after their customers and keep concentrating on producing hundreds of incompatible models, but a definite base from which the could easily return.

    My prediction: 60% chance: Nokia launches the N9; it sees a slow start; Nokia managment fails to put enough technical resources into developing good applications for it. They begin to get cold feet and fail to put enough resources into follow up products. Start talking about "cost cutting". Within 5 years the company fails and is bought for asset stripping. 40% chance: Nokia commits absolutely to Meego; at launch Nokia's new CEO commits to following the I-phone model and providing upgrades for at least 5 years together with masses of free and for pay applications. Within 3 years Nokia is close to Android in market share and within five crushing apple on revenue based on their better logistics chain.

    What's interesting is that the above comes down to the simple question "does the current Nokia CEO have any guts". It's impossible to know until we see what he says at launch time.

  6. Re:Sure on Microsoft Ready To "Take On'' Google and Apple TV · · Score: 1

    The content providers do not really care that you can work around their limitations. They only care to screw over the normal consumer. They will continue to try to stop you but that's just out of a) a spirt of vindictiveness and b) the fear that something that works for you might get packaged as a product for the masses. The only way to "defeat" them is to try to get other free content to become popular. I really don't see much evidence of that happening.

  7. Re:Cel phone jammers! on Using Technology To Enforce Good Behavior · · Score: 1

    I checked online and based on Great Western's web site, it seems that the correct thing to do is to start a vigilante gang. Give people a chance ("please could you turn off your phone") then if they don't react beat them senseless. There's no other useful advice given at all. Hmm.

  8. Re:Can Joe Sixpack be trusted to install RAM? on Oversupply Sends DRAM Prices To One-Year Low · · Score: 1

    According to the guys who used to test this in the company I used to work for ESD doesn't normally cause instant failure. Instead it causes subtle damage and long term failure. Typically by making insulation between on chip components weaker and subject to break down. They measured causes of hardware failure and this was a key one along side temperature variation. Their statement was that at least 80% of random failures could be eliminated in a temperature stabilised data centre where ESD procedures are properly observed. This, of course, assumes that you don't have zinc hair problems.

    I'm not sure how this would play out on consumer hardware where temperature variance is unavoidable, but when it comes to my own stuff I try to ground myself and use anti-static envelopes

    BTW; the reason that you use a strap rather than grabbing ground directly is that this reduces the chance of frying yourself. When you touch live with one hand and grip ground with the other the route from live to ground is through your heart. Think about it. The normal anti-static strap contains an (approximately) 1M Ohm resistor which means that any current to ground through your body is unlikely to cause damage.

    One compromise is to discharge to ground (touch a copper pipe connected deep into the earth e.g.) before doing anything and after every time you walk around but not whilst actually working on the system. Never wear any synthetic clothing whilst working on electronics (all cotton is good; mixtures of different materials bad; synthetic floors terrible). Preferably make sure you use the same ground for yourself and the system. Another safety measure worth checkng you have is a ground leakage (differential) circuit breaker on your electricity supply so that if any current does go through you it gets cut off quickly.

  9. Re:Cel phone jammers! on Using Technology To Enforce Good Behavior · · Score: 1

    You are of course right. I had thought of leaving it on much of the time to stop them talking, but turning on at exactly the moment that they are about to get the address they want sounds much better in any case :-)

  10. Re:Not just them... on Android vs. iPhone — Who Wins In 2011? · · Score: 1

    I guess I may be being double whoooshed, but I don't somehow think the grandparent was serious. Symbian lacks ambition in the devices it's targeted for and will be dead. Maemo on the other hand is being replaced with / morphed into Meego. However, Nokia has already said they won't support upgrades of Maemo devices themselves. That puts a bit of a damper on Maemo for non-technical people. Not to forget the fact that it was released incomplete and doesn't seem to be going to be upgraded much. Don't really think you can say that Maemo is in the running here. Meego won't be in the running until there are some devices in serious use. 2H 2011???

  11. Re:What about the rights of passengers? on Using Technology To Enforce Good Behavior · · Score: 1

    Don't know how they would actually enforce such a law

    If you have a serious accident they check your cellphone records. If you just sent a text message before the accident you are totally screwed. Simple really.

  12. Re:Cel phone jammers! on Using Technology To Enforce Good Behavior · · Score: 2

    Hint; they aren't legal in the US either. And for a good reason. Doctors have started using cellphones instead of pagers and so you shouldn't be blocking them either. If you want to do that, just go for it and make sure you don't get caught.

  13. Re:Not just them... on Android vs. iPhone — Who Wins In 2011? · · Score: 1

    OpenMoko

  14. Re:Like college and grad school on Chinese Intellectual Property Acquisition Tactics Exposed · · Score: 2

    Right; for example nobody nobody suggested harming Julian Assange for publishing anti USA information. Nobody suggested arresting for treason a man who isn't even American. C'mon; pull the other one.

  15. Re:Selection effects on Is Going To an Elite College Worth the Cost? · · Score: 4, Informative
    If you had RTFA:

    In 1999, economists from Princeton and the Andrew W. Mellon Foundation looked at some of the same data Eide and his colleagues had used, but crunched them in a different way: They compared students at more selective colleges to others of "seemingly comparable ability," based on their SAT scores and class rank, who had attended less selective schools, either by choice or because a top college rejected them.

    The earnings of graduates in the two groups were about the same — perhaps shifting the ledger in favor of the less expensive, less prestigious route. (The one exception was that children from "disadvantaged family backgrounds" appeared to earn more over time if they attended more selective colleges. The authors, Stacy Berg Dale and Alan B. Krueger, do not speculate why, but conclude, "These students appear to benefit most from attending a more elite college.")

  16. Re:ruined on Exposing the Link Between Cell Phones and Fertility · · Score: 1

    I wasn't fully sure I believed you so I fact checked. the mirror and at the bottom of the wikipedia talk page and also in the page history.. What a shame for the Telegraph.

  17. Re:ruined on Exposing the Link Between Cell Phones and Fertility · · Score: 2

    Right; whoever reads this is bound by the Slashdot code of secrecy not to explain it to any media people (or other non aware "sheep") at pain of having a dihydrogen monoxide poisoning attempt. Trust me, if you do give the game away, wait two days and then demand your food is tested for DHMO. We will find you. It will be there. We will get it into all and everything you eat.

    (posting as Anonymous so that nobody can trace my packets)

  18. Re:Zionist origin is attested inside Stuxnet code on A Finnish-Chinese Connection For Stuxnet? · · Score: 1

    Hand in your nerd card now. That is the date format. The ISO date format. The only one which alphanumerically sorts in proper order. The one which has no hundred year problem. The one which is easily upgradable to a 10kyear date format without changing ordering. They would use that because it is right. These are people who can make an virus attack on the other side of the world with precision and surprise. They will get the date format right.

  19. Re:Yeah, anywhere on A Finnish-Chinese Connection For Stuxnet? · · Score: 1

    They knew about the design of the facility, but if I read the Symantec decoding of this they did it in a very generic way based on a specific configuration which is quite likely to repeat in all similar centrifuge sites. That would target both Iran and North Korea and even potentially Pakistan I guess. But it also means that it targets any facilities with a similar configuration. It would be very very very interesting to know if their targetting would cause a nuclear leak. If it did, would that be detectable from the outside. If so, did they then identify the location of other secret plants?

  20. Re:Socially engineered attacks ARE a huge problem on NSS Labs Browser Report Says IE Is the Best, Google Disagrees · · Score: 1

    There was nothing wrong with doing the study. I'm sure that there were many such studies done and that's fine. It's the fact that they choose to release this one which is the problem. More important is the way it was released; as an "independent study" as if it had nothing to do with development. That's totally immoral.

    The ways in which this cheated are also clearly discussed elsewhere. They took the Google version at the beginning of the study, but worked on the Microsoft version and took the results at the end. To be fair, either you just study the versions as delivered at the beginning or, better this should have been done as a joint exercise with all the other browser vendors with everybody paying together and competing to improve their products. Then, the vendor with the best results at the end can crow about it.

    The fundamental of honest use of studies is that you must treat each product identically; you must decide at the very beginning of the study whether you will release the data and you must involve the developers of each package studied equally.

  21. Re:Hmm.. now interesting on FBI Alleged To Have Backdoored OpenBSD's IPSEC Stack · · Score: 1
    In the example provided no harmful materials were put in the bridge. I just deliberately left out the screw which would hold it all together.

    Think about it.

  22. Re:Bradley Manning on Today's WikiLeaks News · · Score: 1
    The traitor is you. Quoting from the article you seek to publicize:

    "KUNG-FU TERRORISTS TO TARGET WEMBLEY"

    What the hell? You are afraid that a few terrorists with kung fu powers can overpower hundreds of passengers on a plane. You coward.

    We hijack planes and they are then converted into bombs that can be dropped on to crowds packed into football stadiums, or rammed into skyscrapers during prime-time, killing a quarter of a million in a quarter of an hour.

    There is no way even a mass hijacking will kill quarter of a million. The article says, talking of a reinforced door that "the cabin crew removed it from its hinges", but when we look at the original articles it's pretty clear that there were crew on both sides and so the door was removed from the cockpit side (where the screws are). What you are spreading is pro-terrorist bluster propaganda; giving the terrorists the oxygen of publicity they need; if we were in a war (and we are not) then you and the daily express should be treated as the Quislings you are. Refuse to be frightened. Refuse to be afraid.

  23. Re:Socially engineered attacks ARE a huge problem on NSS Labs Browser Report Says IE Is the Best, Google Disagrees · · Score: 5, Interesting

    So its results are unquestionably incorrect and/or irrelevant?

    They may be technically true in some sense or other. However, in past such situations, Microsoft has been seen commissioning several similar reports; possibly even iterating the instructions for running the reports; then throwing away (under NDA) all the ones which don't match with their marketing wishes. You can basically assume that whatever it says is the opposite of the truth in some way or another because if it was true they would be able to just say directly it instead of commissioning someone else to say it to they can avoid claims of false advertising (for example, their old "Get the Facts" campaign was one of the few things of this type the ASA has clearly stated was misleading). And yes; most companies do this to some extent, but few other companies could come near to sustaining the level of deception Microsoft does because eventually some employee would become disenchanted and start leaking results. For example, have a look at the Comes documents, which only came out because of a lawsuit, to get some idea of the kind of things they can keep secret. Nowadays Microsoft's data destruction policies are much stricter and they ensure that all deals are finalised by lawyers and so are legally privilaged. This kind of secrecy and professional deception means that almost any marketing claim from them should be disregarded completely until there is some level of independent confirmation.

  24. Re:Please correct. on BSD Coder Denies Adding FBI Backdoor · · Score: 1

    There's one other thing. Theo has always stood up for full disclosure. He's regularly gets flack for not doing it enough. He may have also feared that this was a trap, to prove that he keeps things that should be public secret. In fact, given that it seems it's largely or completely untrue, it easily could have been a trap that he didn't fall into. This is just the side effect of him making the best of a bad hand.

  25. Re:The stupidest thing is on First-Sale Doctrine Lost Overseas · · Score: 1

    I think the point is that Omega copied the logo, but didn't license it for Costco to use. The judgement of the 9th court is saying that Costco did need such a license and agrees with all the recent garbage about shrink wrap licenses etc. It's essentially an extension of copyright in a way which is contradicts the US constitution, but is okay and constitutional because the US supreme court says it is. Hey, but INAL; I can only go by the words as they are written, not as they are "interpreted".